RHBA-2015:1722 - Bug Fix Advisory

Topic

Updated OpenStack Networking packages that resolve various issues are now
available for Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for
RHEL 7.

Description

Red Hat Enterprise Linux OpenStack Platform provides the facilities for
building a private or public infrastructure-as-a-service (IaaS) cloud
running on commonly available physical hardware. This advisory includes
packages for:

• OpenStack Networking service

OpenStack Networking (neutron) is a virtual network service for OpenStack.
Just as OpenStack Compute (nova) provides an API to dynamically request and
configure virtual servers, OpenStack Networking provides an API to
dynamically request and configure virtual networks. These networks connect
'interfaces' from other OpenStack services (e.g. virtual NICs from Compute
VMs). The OpenStack Networking API supports extensions to provide advanced
network capabilities (e.g. QoS, ACLs, network monitoring, etc.)

This update addresses the following issues:

• The 'VMware NSX plugin for Neutron' is not yet available in the initial RHEL OpenStack Platform 7 release; it will be added in a later update. (BZ#1186468)
• Under certain circumstances, the L3 agent may have incorrectly started before the OVS agent during the node boot process.

Consequently, when the L3 agent finished configuring a HA router and started up keepalived, it would transition to master and send out gratuitous ARPs before the OVS agent finished plugging its ports. This meant that the gratuitous ARP was lost, but with the router still acting as master.
This update addresses this issue by adding `garp_master_repeat=5` and `garp_master_refresh=10` to keepalived.conf:
garp_master_repeat - Defines how often to send the gratuitous ARP after MASTER.
garp_master_refresh - Periodic delay in seconds between sending gratuitous ARP while in MASTER.
As a result, when transitioning to MASTER state, keepalived sends multiple gratuitous ARPs to ensure that they reach the OVS agent after it has plugged its ports. (BZ#1215177)

• The syntax for using external routers with python-neutronclient was changed in an earlier update.

Consequently, scripts used to create/manage networks stopped working with the RHEL OpenStack Platform 7 beta if using the older '--router:external=True' syntax.
With this update, the previous syntax is again supported, and as a result, networks can be correctly managed without having to update such scripts. (BZ#1221327)

• Previously, no 'python-networking-cisco' package was present in the RHEL OpenStack Platform 7 repositories. Consequently, there was no supported way to bootstrap a setup that used any Cisco Neutron plugins.

This update adds the 'python-networking-cisco' package to the RHEL OpenStack Platform 7 repositories.
As a result, it is now possible to install the 'python-networking-cisco' package, and configure OpenStack Networking (neutron) to use one of those plugins (available as ML2 drivers). (BZ#1230851)

• Previously, stopping the 'network' service would call ifdown on OVS bridges, and remove all ports configured on the OVS bridge. Consequently, once the 'network' service was restarted, required ports were not present in 'ovsdb', resulting in ports being missing in OVS bridges.

With this update, the neutron-openvswitch-agent unit is now restarted upon 'network' service restart. As a result, when the 'network' service is restarted, neutron-openvswitch-agent is restarted as well; this results in sync on the agent side, and the re-creation of missing ports in OVS bridges. (BZ#1252951)

• The enhancement adds the 'python-networking-cisco' package. This enables support for multiple Cisco plugins and drivers in OpenStack Networking (neutron). (BZ#1254153)
• Previously, no VMware drivers for neutron integration were packaged for RHEL OpenStack Platform 7. Consequently, there was no way to integrate RHEL OpenStack Platform 7 with VMware NSX.

This update provides the 'python-networking-vmware-nsx' package; as a result, users are able to install the package and configure VMware NSX integration with neutron without relying on third-party repositories. (BZ#1254220)

Solution

Before applying this update, ensure all previously released errata relevant
to your system have been applied.

Red Hat Enterprise Linux OpenStack Platform 7 runs on Red Hat Enterprise
Linux 7.1.

The Red Hat Enterprise Linux OpenStack Platform 7 Release Notes contain the
following:

• An explanation of the way in which the provided components interact to

form a working cloud computing environment.

• Technology Previews, Recommended Practices, and Known Issues.
• The channels required for Red Hat Enterprise Linux OpenStack Platform 7,

including which channels need to be enabled and disabled.

The Release Notes are available at:
https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux_OpenStack_Platform/7/html/Release_Notes/index.html

This update is available through 'yum update' on systems registered through
Red Hat Subscription Manager. For more information about Red Hat
Subscription Manager, see:

https://access.redhat.com/documentation/en-US/Red_Hat_Subscription_Management/1/html/RHSM/index.html

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat OpenStack 7 x86_64

Fixes

• BZ - 1186468 - Package vmware-nsx driver.
• BZ - 1215177 - VRRP failback after failover does not work
• BZ - 1221327 - --router:external=True syntax is invalid - not backward compatibility
• BZ - 1254220 - add python-networking-vmware-nsx component
• BZ - 1257249 - neutron.conf isn't updated with respect to neutron-dist.conf

CVEs

(none)

References

• http://www.redhat.com/security/updates/classification/#normal